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Abstract 

A central problem in quantum computational complexity is how to prevent entanglement-assisted cheating in 
multi-prover interactive proof systems. It is well-known that the standard oracularization technique completely 
fails in some proof systems under the existence of prior entanglement. This paper studies two constructions of 
two-prover one-round interactive proof systems based on oracularization. First, it is proved that the two-prover 
one-round interactive proof system for PSPACE by Cai, Condon, and Lipton still achieves exponentially small 
soundness error in the existence of prior entanglement between dishonest provers (and more strongly, even if 
dishonest provers are allowed to use arbitrary no-signaling strategies). It follows that, unless the polynomial- 
time hierarchy collapses to the second level, two-prover systems are still advantageous to single-prover systems 
even when only malicious provers can use quantum information. Second, it is proved that the two-prover one- 
round interactive proof system obtained by oracularizing a three-query probabilistically checkable proof system 
becomes sound in a weak sense even against dishonest entangled provers with the help of a dummy question. 
As a consequence, every language in NEXP has a two-prover one-round interactive proof system of perfect 
completeness, albeit with exponentially small gap between completeness and soundness, in which each prover 
responds with only two bits. In other words, it is NP-hard to approximate within an inverse-polynomial the value 
of a classical two-prover one-round game, even when provers are entangled and each sends a two-bit answer to 
a verifier. 
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1 Introduction 



1.1 Background 

Interactive proof systems [3, 16] are a communication model between a polynomial-time probabilistic verifier and 
a computationally unbounded prover. The prover attempts to convince the verifier that a given input string satisfies 
some property, while the verifier tries to verify the validity of the assertion of the prover. It is well-known that the 
model exactly characterizes PSPACE [24, 27], even with a public-coin verifier [17, 28]. Multi-prover interactive 
proof systems were introduced by Ben-Or, Goldwasser, Kilian, and Wigderson [6] as an important generalization 
of interactive proof systems, originally for a cryptographic purpose. In this model, a verifier communicates with 
multiple provers, who are not allowed to communicate with each other. The model turned out to be surprisingly 
powerful as Babai, Fortnow, and Lund [4] proved that it exactly characterizes NEXP. Together with the older 
result by Fortnow, Rompel, and Sipser [14], this gave the first step towards the theory of inapproximability and 
probabilistically checkable proof (PCP) systems [12, 2, 1]. Of particular interests was the power of two-prover 
one-round interactive proof systems. It was already proved in the first paper on multi-prover interactive proofs [6] 
that two-prover systems are as powerful as general multi-prover systems. Cai, Condon, and Lipton [7] showed 
that every language in PSPACE has a two-prover one-round interactive proof system of perfect completeness with 
exponentially small error in soundness. The combination of the results in Refs. [14, 4] implicitly showed that 
every language in NEXP has a two-prover one-round interactive proof system of perfect completeness, but with 
soundness error only bounded away from one by an inverse-polynomial. Feige [11] improved this to constant 
soundness error. Finally, Feige and Lovasz [13] proved that every language in NEXP has a two-prover one-round 
interactive proof system of perfect completeness with exponentially small error in soundness. Thus, the most 
restricted case of multi-prover interactive proofs is as powerful as the most general case of them. Later Raz [26] 
showed the parallel repetition theorem for a two-prover one-round system, which implies that parallel repetition of 
a two-prover one-round system reduces the soundness error exponentially fast. It is stressed that oracularization, 
a method that a verifier uses the second prover to force the functional behavior on the first prover, plays essential 
roles in all of these results except for the parallel repetition theorem. 

From a game theoretic viewpoint, multi-prover interactive proof systems can be viewed as cooperative games 
with imperfect information played by provers and a verifier. More precisely, a -prover r-round interactive proof 
system with a fixed input naturally corresponds to an r-round game played by k cooperative players (provers) 
and a referee (a verifier), where the value of the game is exactly the accepting probability of the underlying proof 
system with the fixed input. For convenience, r-round games with imperfect information played by k cooperative 
players and a referee are called k-prover r-round games in this paper. In physics, the study of quantum nonlocality 
has a long history (see Ref. [32] for instance), and in particular, quantum nonlocality is known to significantly 
affect cooperative games with imperfect information. Even if interactions between a referee and players remain 
classical, sharing prior entanglement among players increases winning probability in some cooperative games [8]. 
This means that multi-prover interactive proof systems may become weaker if provers are allowed to share prior 
entanglement. Indeed, Cleve, H0yer, Toner, and Watrous [8] showed that there are two-prover one-round games 
where unentangled provers cannot win with certainty but entangled provers can. Among others, the example of the 
Magic Square game implies that the oracularization paradigm no longer works well in some proof systems in the 
presence of prior entanglement between the two provers. 

Recently, several methods were proposed to limit the power of dishonest entangled provers in multi-prover 
interactive proof systems. Kempe, Kobayashi, Matsumoto, Toner, and Vidick [20] established two methods to 
modify a classical multi-prover interactive proof system so that dishonest provers cannot cheat perfectly even with 
prior entanglement. One is to use quantum messages, and the other is to introduce an additional prover. As a 
result, they proved that, even in the presence of prior entanglement among dishonest provers, every language in 
NEXP has (a) quantum two-prover one-round and (b) classical three-prover one-round interactive proof systems 
of perfect completeness, although the proved gap between completeness and soundness is exponentially small. 
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They asked whether or not a result similar to these holds even in the case of classical two-prover one-round. Ito, 
Kobayashi, Preda, Sun, and Yao [19] proved the existence of a proof system with such properties even with a 
classical three-prover one-round binary interactive proof system, where each prover answers only one bit, and even 
against commuting-operator provers, a model of pro vers based on the work by Tsirelson [30]. Commuting-operator 
provers are at least as powerful as usual entangled provers, and capture the case where provers share an entangled 
state of infinite dimension. Kempe, Kobayashi, Matsumoto, Toner, and Vidick [20] also analyzed the classical 
two-prover one-round interactive proof system which is obtained by applying oracularization to the public-coin 
single-prover multi-round interactive proof system, and proved that PSPACE has classical two-prover one-round 
interactive proof systems of perfect completeness with soundness error bounded away from one by an inverse- 
polynomial even against entangled provers. Since the parallel repetition theorem is not known to hold when the 
provers are entangled, it remained open if PSPACE has classical two-prover one-round interactive proof systems 
that achieve arbitrarily small errors even with entangled provers. In fact, the resulting proof system after parallel 
repetition is exactly the one for which Cai, Condon, and Lipton [7] achieved exponentially small soundness error 
against unentangled provers. Recently, Holenstein [18] proved that the parallel repetition theorem holds even for 
two-prover one-round interactive proof systems with no-signaling provers. 

1.2 Main results 

This paper presents two results on the power of (classical) two-prover one-round interactive proof systems against 
dishonest entangled provers. Let poly be the set of polynomially-bounded functions that are computable in poly- 
nomial time, and let MIP* s (2, 1) and MIP" S S (2, 1) be the classes of languages having two-prover one-round inter- 
active proof systems with completeness at least c and soundness at most s, where the provers are allowed to share 
prior entanglement and to use arbitrary no-signaling strategies, respectively. 

First, it is proved that the two-prover one-round interactive proof system for PSPACE by Cai, Condon and Lip- 
ton [7] still achieves exponentially small soundness error against dishonest entangled provers, and more strongly, 
even against dishonest no-signaling provers. Actually, it is crucial to consider the soundness against no-signaling 
provers since the proof uses the parallel repetition theorem of two-prover one-round games with no-signaling 
provers due to Holenstein [18]. 

Theorem 1. Every language in PSPACE has a two-prover one-round interactive proof system that has perfect 
completeness with honest unentangled provers and exponentially small soundness error against dishonest no- 
signaling provers. In particular, for any p G poly, 

PSPACE C MIP* 2 _ P (2, 1) n MIP^ 2 _ P (2, 1). 

To prove Theorem 1, we start with a public-coin single-prover interactive proof system for PSPACE, and 
oracularize it to obtain a two-prover one-round interactive proof system, as done by Kempe, Kobayashi, Matsumoto, 
Toner, and Vidick [20]. In the constructed system, the verifier sends the whole sequence of r public-coin questions 
in the original system to the first prover at one time, where r is the number of rounds in the original system. 
The verifier then uniformly chooses a round k G {1, . . . , r}, and sends only the first k public-coin questions to the 
second prover. The verifier checks that (i) the r public-coin questions and the r answers from the first prover form an 
accepting conversation in the original system (Simulation Test), and (ii) the k answers from the second prover 
are all consistent with the first k answers from the first prover (CONSISTENCY Test). It is proved that this two- 
prover one-round interactive proof system has soundness error bounded away from one by an inverse-polynomial 
even against dishonest no-signaling provers (previously, the soundness was shown only against dishonest entangled 
provers in Ref. [20]). Now this proof system is repeated in parallel polynomially many times. The resulting 
proof system is exactly the one analyzed by Cai, Condon, and Lipton [7] in the classical setting with unentangled 
provers. The parallel repetition theorem with no-signaling provers [18] shows that the resulting system achieves 
exponentially small soundness error. Since entangled provers and commuting-operator provers are special cases of 
no-signaling provers, the same soundness holds even against provers of these types. 
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When proving soundness, we construct a strategy of the single-prover system from a no-signaling strategy of 
the oracularized system. This can be viewed as a rounding in the terminology in Ref. [20]. The original rounding 
in Ref. [20] uses post-measurement quantum states. Since there is no notion corresponding to post-measurement 
states in the case of no-signaling provers, this paper presents a new method of rounding, which is essential for 
proving a bound for no-signaling strategies. 

Theorem 1 implies that unless AM = PSPACE, in particular unless the polynomial-time hierarchy collapses 
to the second level, two-prover systems are still advantageous to single-prover systems even when only dishonest 
provers can use quantum information. To the best knowledge of the authors, this is the first nontrivial lower bound 
on the power of two-prover one-round interactive proof systems with entangled and no-signaling provers. 

Since any two-prover one-round interactive proof system with no-signaling provers is efficiently simulatable 
by solving a linear program of exponential size, Theorem 1 implies that PSPACE C MIP" S S (2, 1) C EXP for any 
polynomial-time computable functions c, s satisfying c > s. 

Next, it is proved that every language in NEXP has a (classical) two-prover one-round interactive proof system 
of perfect completeness with soundness bounded away from one even against entangled provers (actually against 
commuting-operator provers), although the gap between completeness and soundness is exponentially small. This 
affirmatively answers the question posed in Ref. [20]. More precisely, the following is proved. 

Theorem 2. Every language in NEXP has a two-prover one-round interactive proof system satisfying the following 
properties: 

( i) Each prover responds with two bits. 

( ii) It has perfect completeness with honest unentangled provers. 

(Hi) It has soundness error at most 1 — 2~ p against dishonest commuting-operator provers (hence also against 
dishonest entangled provers) for some p G poly depending on the language. 

(iv) It has constant soundness against dishonest unentangled provers. 

In particular, properties ( ii) and ( Hi) imply 

NEXPC (J MIP* 1 _ 2 _ P (2,1). 

pGpoly 

Note that this is in contrast to the case with no-signaling provers, where for any p G poly, 
MIP^ 1 _ 2 _ P (2,1) C EXP. 

To prove Theorem 2, we start with a nonadaptive three-query PCP system of perfect completeness, and oracu- 
larize it to obtain a two-prover one-round interactive proof system. In the usual oracularization, the verifier sends all 
the three questions in the original PCP system to the first prover to simulate the original PCP system (SIMULATION 
Test), and one of the three chosen uniformly at random to the second prover to check the consistency with the 
first prover (CONSISTENCY Test). However, this is not sufficient for our purpose, since the example of the Magic 
Square game implies that the system is perfectly cheatable by entangled provers when the underlying PCP system 
has a very bad structure. The main idea to overcome this difficulty is that the verifier sends a dummy question 
to the second prover in addition to the original question used to check the consistency — the verifier randomly 
chooses one dummy question from all the possible questions in the original PCP system, and sends both of the 
original question for the CONSISTENCY Test and this dummy question to the second prover (of course, without 
revealing which one is dummy). The verifier checks the consistency using the answer for the real question, and 
just ignores the answer for the dummy question. The intuition behind this is as follows. In order to cheat the proof 
system, the answers from the first prover must be highly nonlocally correlated to the answer to the real question 
from the second prover. However, the second prover would be forced to use entanglement even for the dummy 
question, since he does not know which one is dummy. Now the answers from the first prover could not be highly 
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nonlocally correlated only to the answer to the real question from the second prover, due to monogamy of quantum 
correlations [29]. It turns out that this dummy question is sufficiently helpful to at least prove the following two 
properties whenever the provers use a commuting-operator strategy that passes the CONSISTENCY TEST with very 
high probability: (a) for each measurement operator M used by one prover, there is a measurement operator by the 
other prover whose effect is close to M when applied to the shared state, and (b) the measurement operators by 
each prover are pairwise almost commuting when applied to the shared state. These two properties are also key in 
the proof in Ref. [20], and our new contribution lies in presenting a method to derive these properties by using only 
two provers and classical messages. Once these properties are obtained, one can use a rounding technique similar 
to Ref. [20] to construct a (randomized) PCP proof of the original system from the entangled strategy with these 
two properties so that the accepting probability with such entangled provers is not very far from that in the original 
PCP system when the constructed PCP proof is given. This implies that the first prover fails in the Simulation 
Test with high probability whenever the provers passes the CONSISTENCY TEST with very high probability, and 
proves the soundness bound. Since NEXP has nonadaptive three-query PCP systems of perfect completeness 
with constant soundness error [5] (using polynomially many random bits), the above argument essentially shows 
Theorem 2. Finally, the property (i) of Theorem 2 that two-bit-answer systems are sufficient follows from the 
nonadaptive three-query PCP system naturally induced by the scaled-up version of the inapproximability result of 
1-IN-3 3SAT by Khanna, Sudan, Trevisan, and Williamson [22] — it is NEXP-hard to distinguish whether a given 
instance of SUCCINCT 1-IN-3 3SAT is satisfiable or at most a constant fraction of its clauses is simultaneously 
satisfiable. Since the underlying PCP system is for SUCCINCT 1-IN-3 3SAT, there are at most three possibilities 
for the answer of the first prover, which can be encoded in one trit (and thus in two bits). 

The same argument can be applied to a nonadaptive three-query PCP system for NP, which proves the NP- 
hardness of approximating the entangled value of a two-prover one-round game. For a two-prover one-round game 
G, let w unen t(G), w ent {G), and w com (G) denote the unentangled, entangled, and commuting-operator values of 
G, respectively, i.e., the values of the game G when played optimally by unentangled, entangled, and commuting- 
operator provers. 

Corollary 3. The following promise problem is NP -complete. 

Input: A two-prover one-round game G with two-bit answers and an integer k > 1, where G is rep- 
resented as the complete tables of the probability distribution it over two questions q\ , q2 and of 
the predicate R of the referee, and k is represented in unary. 

Yes-instance: w uncn t(G) = 1. 

No-instance: w com (G) < 1 — 1/k. 

(This condition is at least as strong as the condition w en t(G) < 1 — 1/k.) 

Corollary 3 implies that, unless P = NP, there does not exist a fully polynomial time approximation scheme 
(FPTAS) to approximate w ea t(G) or w com (G) where G is a classical two-prover one-round game with two-bit 
answers. In particular, the entangled value of such games cannot be represented by a semidefinite program of 
polynomial size, unlike the so-called XOR games [30, 31, 8]. Corollary 3 is also in contrast to the case of two- 
prover one-round games with binary answers, where it is efficiently decidable whether the entangled value of the 
game is one or not [8]. 

Remark. In fact, the answer from one of the provers can be limited to one trit in Theorem 2 and Corollary 3. Also, 
as will be presented in Section 4, the games used in the proof of Theorem 2 and Corollary 3 can be restricted to two- 
to-two games. For a two-to-two game G, there is a polynomial-time algorithm based on semidefinite programming 
that decides whether w cnt (G) = 1 or w cnt (G) < 1/20 [21]. 
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2 Preliminaries 



2.1 Notations and useful facts 

We assume familiarity with the quantum formalism, including the definitions of pure and mixed quantum states, 
admissible transformations (completely-positive trace-preserving mappings), measurements, and positive operator- 
valued measures (POVMs) (all of which are discussed in detail in Refs. [25, 23], for instance). This section 
summarizes some of the notions and notations that are used in this paper. 

Throughout this paper, let N and Z + denote the sets of positive and nonnegative integers, respectively. For 
every N G N, let [N] denote the set of all positive integers at most N. Let poly be the set of functions p: Z + — > N 
such that l p ( n ) is computable in time polynomial in n. For any finite set S, we associate with S the Hilbert space 
C of dimension \S\ whose orthonormal basis is given by {\s} : s G S}. For any Hermitian operator A, the trace 
norm of A is defined as \\A\\ tr = tr\/AtA. For any Hilbert space H, D(W) denotes the set of density operators 
over H. For any Hilbert spaces H and /C, T(H,IC) denotes the set of admissible transformations from D(7Y) to 
D(/C). 

For any Hilbert space H and any finite sets S and T, two POVMs M = {M s } seS and N = {N t }teT over H 
mutually commute if [M s , N t ] = M s N t - N t M s = for any s £ S and t G T. 

For any finite set S and for any probability distributions p and q over S, the statistical difference between p and 
q is defined as SD(p, q) = \ YlseS \p( s ) ~ Q( s )\ - F° r an y Hilbert space Ji and for any density operators p and a in 
Y){H), the trace distance between p and a is defined as D(p, a) = ^\\p — a\\ tr . The following properties will be 
used in the subsequent sections. 

Fact 1. For any Hilbert space H and for any pure quantum states \<j>) and in H, 

Dm^mm = vi-k^)i 2 - 

Fact 2. For any Hilbert spaces H and JC, any density operators p and a in D(H), and any admissible transformation 
T in T(H, 1C), 

D(T(p),T(a))<D(p,a). 

In particular, Fact 2 implies that, for any Hilbert space H, any finite set S, and any POVM M = {M s } se s over 
H, D(p,a) > \ J2 seS |trM s p - txM s a\ = SD {p M (p),p M (a)), where and p M (a) are the probability 

distributions over S naturally induced by performing the measurement associated with M on p and a, respectively. 

In what follows, D(\(f>)((f>\, (^(V'l) f° r P 111 ^ states \4>) and in H is often simply denoted by D(\(/)), \ip)), 
and (D(p, a)) 2 is denoted by D 2 (p, a). 

2.2 Games 

This subsection introduces three types of games that are discussed in this paper: two-prover one-round games, 
nonadaptive-query single-prover multi-round games, and nonadaptive three-query PCP games. 

The notion of games are intimately related to the notion of interactive proof and probabilistically checkable 
proof systems. We assume familiarity with these proof systems, see, e.g., Refs. [10, 15]. 

For convenience, a family {6> s } se s of probability distributions over a set T is often simply denoted by 6, 
sometimes even without mentioning the underlying sets S and T when it is not confusing. Also, the probability 
6 s {t) is often denoted by 9(t \ s). 

Two-prover one-round games 

Two-prover one-round games are cooperative simultaneous games played by two cooperative players Pi and P2 
with a referee V. In what follows, the referee and players are called the verifier and provers, respectively, for the 
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terminological consistency with multi-prover interactive proofs. A two-prover one-round game G is specified by a 
six-tuple (Qi, Q2, A\, A2, R, it), where Q\, Q2, A\, and A2 are finite sets, R: Q\ x Q2 x A\ x A2 — > {0, 1} is 
a predicate, and ir is a probability distribution over Q\ x Q2. The verifier V chooses a pair (gi, 02) of questions 
from Qi x Q2 according to ir, and sends % to the prover Pj for each i G {1, 2}. Each Pj answers a« G A; L , and the 
provers win the game if and only if P(gi, 02, 01,02) = 1. Following convention, P(gi, 02, a±, 02) is denoted by 
R(ai,a,2 I <?i, (72) in this paper. 

A strategy of the provers in a two-prover one-round game G = (Qi , Q2 , A\ , A2 , R, it) is a fam- 
ily 9 = {0q 1 ,q 2 \(q 1 ,q 2 )eQixQ2 °f probability distributions over A\ x A2 indexed by each element in 
Qi x Q2- This can be interpreted as the provers jointly answering (01,02) 6 vli x A2 with probability 
■, a 2 I 01,02) — 9q ltQ2 (ai, 02) when the verifier asks gi S Qi to the first prover and q2 G Q2 to the second 
prover. Depending on the resources the provers can use, this paper considers the following four classes of strate- 
gies of the provers. 

The smallest one is the class of unentangled (or classical) strategies in which the provers are allowed to share 
any classical random source before the game starts. Each prover can use his private random source also, and can 
be an arbitrary function depending on the question he receives and the shared and private random sources. 

The second smallest class is that of entangled strategies in which the provers are allowed to share an arbitrary 
quantum state in a Hilbert space Pi <8> P2, where each V\ and V2 can be arbitrarily large Hilbert space of finite 
dimension. Each prover Pj can perform an arbitrary POVM measurement over Pj that depends on the question he 
receives, and he answers with this measurement outcome. 

A more general one is the class of commuting-operator strategies in which the provers are again allowed to 
share any quantum state in a Hilbert space V, but now V can be infinite-dimensional. Each prover Pj can perform 
an arbitrary POVM measurement over V as long as the measurement by Pi commutes with that by P2. 

Finally, the largest one of the four is the class of no-signaling strategies in which the provers are allowed to 
do anything as long as their behavior viewed from the outside does not imply signaling between the two provers. 
Formally, a strategy 9 is no-signaling if for any i G {1,2} and for any question qi G Qi, the marginal distribution 

^2 0(ai,a 2 I qi,q 2 ) 

does not depend on the choice of q^-i- 

The winning probability or the accepting probability of a strategy 9 is given by 

^2 K(qi,q 2 ) ^ 9(a 1: a 2 \ qi, 92)^(01, a 2 \ qi, q 2 )- 

(<2i,<?2)eQixQ 2 (ai,a 2 )eA 1 xA 2 

By convexity argument, the classical random source is not necessary when considering the optimal unentangled 
strategy. Similarly, it is assumed without loss of generality that the shared state is pure and the measurement by the 
provers are projective in entangled and commuting-operator strategies. 

Corresponding to the four classes of strategies, a game G has four values: the unentangled value w unen t(G), 
the entangled value w en t(G), the commuting-operator value (or the field-theoretic value in the terminology used 
in Ref. [9]) w com (G), and the no-signaling value w ns (G). All of these are defined as the supremum of the winning 
probability in G over all strategies in that class. The unentangled and the no-signaling values are known to be 
attainable. Clearly, 

< w micnt (G) < w cnt (G) < w com (G) < w ns (G) < 1. 

Holenstein [18] showed the following parallel repetition theorem for the no-signaling values of two-prover 
one-round games. 

Theorem 4 ([18]). There exist positive constants c and a such that for any two-prover one-round game G 
and any n G N, the two-prover one-round game G n obtained by the n-fold parallel repetition of G satisfies 
w ns (G n ) < (I - c(l - w ns (G)) a ) n . 
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Nonadaptive-query single-prover multi-round games 

Nonadaptive-query single-prover multi-round games are games played by a single player (a prover) P with a 
referee (a verifier) V. A nonadaptive-query single-prover r-round game G is specified by a quadruple (Q, A, R, tt), 
where Q and A are finite sets, R : Q r x A r —> {0, 1} is a predicate, and tt is a probability distribution over Q r . 
At the beginning of the game G, the verifier V chooses an r-tuple (qi,...,q r ) of questions from Q r according 
to 7T. At the jth round for each 1 < j < r, V sends qj to the prover P, and P answers a,j G A. The prover 
wins the game if and only if R(q±, . . . , q r , ai, . . . , a r ) = 1. Similarly to the case of two-prover one-round games, 
R(qi, . . ■ , q r , ai, . . . , a r ) is denoted by R(ai, . . . , a r \ qi, . . . , q r ) in this paper. 

A strategy of the prover in a nonadaptive-query single-prover r-round game G = (Q, A, R, tt) is a sequence 
6 = (9^\ . . . , # (r )) of r families of probability distributions over A, where Qk>) is a family indexed by each element 
in Qi x A* -1 . This can be interpreted as the prover answering ctj G A at the jth round, for each 1 < j < r, with 
probability 9^\aj \ qi, . . . , qj, a\, . . . , aj-i) when the conversation between the verifier and the prover so far 
forms a sequence (qi, a\, . . . , qj-i, a,j-i,qj) G (Q x A)^ 1 x Q. 

A strategy 6 naturally induces a family {#<?i,...,g r }(g 1 ,...,, ?r )eQ r OI probability distributions over A r defined by 

r 

qi ,...,q r (ai, ■ • • ,a r ) = Y[9 i - 3 \a j \ q u . . . ,qj,ai, . . . ,aj-i), 
i=i 

and as before, 9 qil ... t q r (ai, . . . , a r ) is denoted by 6(a\, . . . ,a r \ qi, . . . , q r ). The winning probability or the accept- 
ing probability of the strategy is given by 

^2 7r(q 1 ,...,q r ) ^ 9(a 1 ,...,a r \q 1 ,...,q r )R(a 1 ,...,a r \q 1 ,...,q r ). (1) 

qi,...,q r £Q ai,...,a r &A 

The value w(G) of the game G is the maximum winning probability over all strategies of the prover. 
It is noted that we allow the strategies of the prover to be probabilistic so that analyses in Section 3 become 
easier, although there always exists a deterministic optimal strategy. 

Nonadaptive three-query PCP games 

Nonadaptive three-query PCP games are one-way communication games played by a single player (a prover) P 
with a referee (a verifier) V. A nonadaptive three-query PCP game G is specified by a quadruple (Q,A,R,tt), 
where Q is a positive integer, A is a finite set, 1 R: [Q] 3 x A 3 -► {0, 1} is a predicate, and tt is a probabil- 
ity distribution over the set {{qi,q2,qs)'- 1 < Qi < Q2 < Q3 < Q} C [Q] 3 . The game starts with the prover P 
sending a string II G A® on alphabet A of length Q. The verifier V chooses three positions q\, g^, and q%, 
1 < Qi < Q2 < Q3 < Q, according to tt, and reads the three letters a\, a>2, and 03 of II in the corresponding posi- 
tions. The prover wins the game if and only if R(q\,q2, (73, a±, 02, 03) = 1. As before, R{qi,q2,Q3, 0-1,0-2,0-3) is 
denoted by R(ai,a 2 , a 3 \ qi, q 2 , q 3 )- 

A strategy of the prover in a nonadaptive three-query PCP game G = (Q,A,R, tt) is a probability distribution 9 
over A®. This can be interpreted as the prover preparing a string II G A® with probability #(n). For notational 
convenience, the gth letter of II is denoted by II [q], for each 1 < q < Q. 

The strategy 9 naturally induces a family of probability distributions over A 3 indexed by [Q] 3 defined as 

9(a 1 ,a 2 ,a 3 \ q!,q 2 ,q3) = ^ 0(11). 

U[ qi }=a z (i=l,2,3) 

'Some might prefer to fix A to the binary answer {0, 1} to make the definition consistent with the name, since "nonadaptive three-query 
PCP systems" usually refer to such PCP systems with the binary alphabet. Actually, in the proofs of Theorem 2 and Corollary 3, we only 
use the case where A = {0, 1}. However, we use this definition to make it consistent with the definitions of games of other kinds. 
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The winning probability or the accepting probability of a strategy 6 is given by 

^(91,92,93) 0(n)i2(n[ g i],n[(/2],n[ g 3] | 91, 92,93) 

i<gi<g2<93<Q neA<3 

= ^(91,92,93) ^ ( a i) a 2,a 3 I 91,92,93)^(01,02,03 I 91,92,93). 

1<<71<92<<?3<<3 ai,a2,a3eA 

The value w(G) of the game G is the maximum winning probability over all strategies of the prover. 

As in the case of nonadaptive-query single-prover multi-round games, we allow the strategies of the prover to 
be probabilistic so that analyses in Section 4 become easier, although there always exists a deterministic optimal 
strategy. 

Remark. In the definition of nonadaptive three-query PCP games, the order of locations 1, . . . , Q is used only to 
define the unique order of a triple (gi, 92, 93). Relabeling locations does not affect the essential meaning of the 
game or the value of the game. 

2.3 Oracularizations 

Oracularization of a game is a way of transforming the game to a two-prover one-round game, where the second 
prover is used to force some functional behavior on the first prover. 

Oracularization of nonadaptive-query single-prover multi-round games 

For a nonadaptive-query single-prover r-round game G = (Q, A, R, ir), oracularization of G gives the two-prover 
one-round game G' = (Q r , Q2, A r , A2, R', ir'), where the finite sets Q2 and A2, the predicate R', and the proba- 
bility distribution ir' are specified below. 

Let Q2 = Ufce[r] Q k an d ^2 = Ufce[r] A k . ^ ne verifier V' in G' chooses (qi,...,q r ) G Q r according to ir and 
k G [r] uniformly at random, and sends (qi,...,q r ) to the first prover and (qi, . . . , q^) to the second prover. This 
specifies the probability distribution n' over the set Q r x Q2. Upon receiving answers (a±, . . . , a r ) G A r from the 
first prover and (a[, . . . , a' k ,) G A k from the second prover, V performs the following two tests: 

(Simulation Test) V verifies that R(ai, . . . ,a r \ 91, . . . ,q r ) = 1, 

(Consistency Test) V verifies that k = k' and aj = a'j for every j e [k]. 

The provers win if and only if they pass both of the two test. This specifies the predicate 

R': Q r xQ 2 xA r xA 2 ^ {0,1}. 

Oracularization of nonadaptive three-query PCP games 

For a nonadaptive three-query PCP game G = (Q, A, R, ir), oracularization of G gives the two-prover one-round 
game G' = ([Q] 3 , [Q],A 3 , A, R' , ir'), where the predicate R' and the probability distribution ir' are specified below. 

The verifier V in G' chooses three positions q\, q2, and q^, 1 < 91 < 92 < 93 < Q, according to ir, and then 
chooses q 6 {91, 92, 93} uniformly at random. V' sends (91, 92, 93) to the first prover and q to the second prover. 
This specifies the probability distribution ir' over the set [Q] 3 x [Q]. Upon receiving answers (01,02,03) G A 3 
from the first prover and a G A from the second prover, V performs the following two tests: 

(Simulation Test) V verifies that R(ai,a 2 , a 3 | 91, 92, 93) = 1, 

(Consistency Test) V verifies that a = aj when q = qj. 
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The provers win if and only if they pass both of the two tests. This specifies the predicate 
R': [Qf x [Q] x A 3 x A ->■ {0,1}. 

The following result is implicit in Ref. [14] (combined with Refs. [4, 6]). 

Theorem 5 ([14, 4, 6]). For a nonadaptive three-query PCP game G and its oracularization G', 



3 Two-prover one-round system for P SPACE 

This section analyses the two-prover one-round game constructed by oracularizing a nonadaptive-query single- 
prover multi-round game, and proves Theorem 1 that every language in PSPACE has a two-prover one-round 
interactive proof system of perfect completeness with exponentially small soundness error against no-signaling 
provers. 

3.1 Key lemma 

Given a nonadaptive-query single-prover multi-round game G, let G' be the two-prover one-round game obtained 
by oracularizing G. As stated in the introduction, Theorem 1 is proved by first relating the value of the original 
game G with the no-signaling value of the oracularized game G', and then repeating G' in parallel. The main part 
of the proof of Theorem 1 is to show the following lemma, which relates w ns (G') with w(G). 

Lemma 6. Let G be a nonadaptive-query single-prover r-round game, and let G' be the two-prover one-round 
game obtained by oracularizing G. Then, 



The proof of Lemma 6 is deferred to the next subsection. Assuming Lemma 6, it is easy to prove Theorem 1, 
by using the following celebrated characterization of PSPACE. 

Theorem 7 ([24, 27, 17, 28]). Every language in PSPACE has a public-coin single-prover interactive proof sys- 
tem of perfect completeness with soundness error 2~ p for any p G poly. 

Proof of Theorem 1. Let L be a language in PSPACE. Then, from Theorem 7, L has a public-coin single-prover 
interactive proof system of perfect completeness with soundness error at most 1/2. Given an input of length n, the 
system uses r(n) rounds for some r G poly. The oracularization of this proof system gives a two-prover one-round 
interactive proof system that clearly achieves perfect completeness with unentangled honest provers. Lemma 6 
implies that the soundness error in the constructed two-prover one-round system is at most 1 — ^ against no- 
signaling dishonest provers. Finally, Theorem 4 shows that, for any p G poly, there exists t G poly such that 
repeating this system t times in parallel reduces soundness error to at most 2~ p even against no-signaling dishonest 
provers, which completes the proof. □ 

3.2 Proof of Lemma 6 

Fix a nonadaptive-query single-prover r-round game G = (Q, A, R, it), and let G' = (Q r , Q2, A r ,A2, R', it') be 
the oracularization of G. 

For any q = (qi, . . . , q r ) in Q r , a = (a±, . . . , a r ) in A r , and k G [r], let q[\^\ an d a [i,fc] denote (qi, . . . , q^) 
and (ai, . . . , cifc), the prefixes of q and a of size k, respectively. 

Consider any no-signaling strategy 6' in G', and let e be the probability that the provers loses in G' when using 
the strategy 6'. It is assumed without loss of generality that, in the strategy 9', the second prover always answers 



W(G) < ^unent(G') < 1- 



l-w{G) 
3 



w ns (G') < 1 



l-w(G) 
3r 
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an element in A k when he receives a question in Q k (otherwise it only decreases the winning probability of the 
pro vers). We shall prove that e > 1 ~™} G ^ ■ 

Let e cons and e sim be the probabilities that the strategy 0' fails in Consistency Test and Simulation Test, 
respectively. Obviously, e > max{e cons , £ s i m }- 

For each q G Q r , let e cons (q) be the probability that 6' fails in CONSISTENCY TEST conditioned on the question 
to the first prover being q. Furthermore, for each q G Q r and k G [r], let £ CO ns k) be the probability that 9' fails in 
Consistency Test conditioned on the questions to the first and second prover being q and qy^y The following 
relations are obvious: 

Econs = Y 7T(g)£ cons (<?), 

£cons(</) = — y ] £ cons(Qi k), 
ke[r] 

£cons(q,k)= Y 0'{a,a' \q,q [l k] ). 

aeA r ,a'eA k : 0[i jfc ]^o' 

Next, for each k G [r], let e(k) be the probability that 8' fails in either Consistency Test or Simulation Test 
conditioned on the question to the second prover being in Q k . Again, the following relation clearly holds: 

ke[r] 

From the no-signaling conditions, for each q G Q r and k G [r], the probability distribution a q over A r of 
answers from the first prover when asked q does not depend on k the verifier has chosen. Or equivalently, 
a q (a) = ^2 a , £A k 0'{a, a' \ q, qy^ k y) does not depend on the choice of k. Similarly, for each q = (qi, . . . , q r ) G Q r 
and k G [r], the probability distribution (3 q[lk] over A k of answers from the second prover when asked qy t k] 
does not depend on qk+i, ■■■ ,q r - That is, for each k G [r], each qy yk \ G Q h > an d each a' G the probability 
^9[i,k] ( a ') = Soe^ ^'( a > a ' I 9, does not depend on g fc+1 , ... ,q r . For each q G Q r and fc G [r], let a Qyk 

be the probability distribution over A k defined by a q ^(a') = J2 a eA r - a {1 k] =a' a q( a )- ^ * s P rove d that a q ^ and 
j3 q[1 k] are close to each other. 

Claim 1. For each q G Q r and k G [r], 



SD(a Qjk , P q[1M ) < e cons (q,k). 



Proof. By definitions, 



a q , k (a')= Yj «<?(«)= Y J2 9 '( a > a " I 9.9[i,fc]). 

aeA r : 0[i ]fc ]=o' aeA>- : a [ljfe] =a' a "eA fc 

while 

/ 3 9 [ i, fc] ( a ') = Y 9 '( a > a ' I 9.9[i,fc])- 
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Therefore, 



> fc '^<J[l,fc]) " 


~- 2 E 

a'GA fe 


(«')-/W°')l 




=- e 

a'€A k 


E 

aGA r : 0[i ifc] =a' 


E 0'( a > a " 1 9»9[i,fc]) " E 0/ ( a ' a ' 1 9.9[i,fc]) 

a"GA fe aGA r 




= - E 

2 ^ 

a'€A k 


E 

aGA r : 0[i ifc] =o' 


2 flWlfl^i,*])- E d '^ a '\ 

a"eA k :a"^a' aeA r : a [ljfc] ^a' 


< 1 E 

a'eA k 


f E E I«l>9[i,k]) + E 

\aeA r : a [l fc] =o' a "£#: o"/o' aGA^: a [ljfc] ^a' 


'(a, a' 


E 

aeA r ,a'GA fe : a[ lifc j^a' 


a, a' 1 <Jf,g[i,fc]) 




= Scons (Qj k), 







as desired. □ 

Now we construct a strategy 6 = {9^\ . . . , 6^) in G as follows. Suppose that, just after the verifier has sent 
a question at the /cth round, k G [r] , the conversation between the verifier and the prover so far forms a sequence 
(<7i) a i, Q2, 0,2, • • • , Qk-i-, o-k-i, <7fc)> where each qj, j G [&] is an element in Q, and each cij, j E [k — 1] is an element 
in A. Let fc j = (<Zi, • • • , (&) and a^j,^ = (ai, . . . , afc_i). The prover answers a& at this round with probability 

f)( k )(n \ n n \ ^ ^Wl^fc]) 

^ '{ a k I Q[l,fc],a[l,fc-l]j - ^ 7. 77 TV- (3) 

If /c = 1, the denominator of the right-hand side of Eq. (3) is treated as one. In case the denominator is zero, the 
value of 9( k \a,k \ Q[i : k], a [i,fe-i]) i s defined arbitrarily as long as it is nonnegative and its sum over is equal to 
one. 

This strategy can be interpreted as follows. At the first round, the prover in G receives only one question, 
say q\ G Q. He simulates what the second prover would do in G' when asked q\, and reports the simulated 
answer a\ G A to the verifier. At the /cth round, k > 2, suppose that the conversation between the verifier and 
the prover until the (k — l)st round forms a sequence (q±, ai, q2,&2, ■ ■ ■ , Qk-i, ^fc-i)- Then the prover in G when 
asked q^ at the kth round simulates the behavior of the second prover in G' with question q' = (qi, . . . , If 
the simulated answer is of the form a' = (ai, . . . , ak-i, a&) for some at G A (i.e., the first k — 1 elements of the 
simulated answer are consistent with what he has answered so far), he responds with to the verifier. Otherwise 
(if the simulated answer contains an inconsist element), he discards it and retries the simulation until he obtains a 
consistent answer. 

This 6 can be viewed as a rounded strategy in the terminology in Ref. [20]. It is noted, however, that is 
different from the original rounded strategy used in Ref. [20] at least in the following two points: 

(i) In the rounded strategy in Ref. [20], the prover uses the post-measurement quantum state. Since the concept 
of post-measurement states is not applicable to no-signaling strategies, the prover with strategy restarts the 
simulation of the second prover in each round. 

(ii) Because of (i), there is no guarantee that the prover in G should obtain with high probability a simulation 
result that is consistent to what he has already answered. Therefore, in strategy 6, if the simulation result is 
inconsistent with the conversation so far, the prover restarts the simulation instead of aborting the game. 
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Hence, even if the no-signaling strategy 8' in G' is in fact an entangled strategy, our construction gives a strategy 
6 that is different from the rounded strategy used in Ref. [20]. The authors believe that this difference is essential 
when proving a bound for no-signaling strategies. 

To bound e from below, we relate e to the winning probability of 6 in G by hybrid argument. For each fc G [r] , 
let be a family of probability distributions over A r indexed by each element in Q r defined by 

r 

h { q ] {a) = f3 q[lM (a [lM ) JJ 0«( Oi | g [M] , a [M _i]). 

i=k+l 

Note that, in general, the family of distributions for k > 2 is not induced from any valid strategy of the prover 
in G because the prover has to know the first k questions before answering to the first question. For each fc G [r] , 
let pk be the probability that this "imaginal strategy" wins in G, i.e., let pj, be such that 

Pk= ^2 tt(<?) £ h { q\a)R{a \ q). 

qeQ r aeA r 

Note that is identical to the family of probability distributions induced by the strategy 6, and thus, p\ < w(G). 
Also note that is identical to the family of probability distributions induced by the behaviour of the second 
prover in G' when asked a question in Q r , and thus, p r > 1 — e(r). 

Claim 2. For any q G Q r and any k, 2 < k < r, 

ST){h { q~ l \h { q ) ) < e cons (q,k- 1) +e cons (q,k). 
Proof. By definition, for any k, 2 < k < r, and for any q G Q r and a = (ai, . . . , a r ) G A k ~ 1 , 
4 fe - 1} (a)-4 fe) (a) 

r 

= (/V, fc -i]( a [i,fc-i])0 W K I 9[i,fc],a[i,fc-i]) -A?[i, fc] ( a [i,fc])) II I 

j=fe+i 

This implies that, for any k, 2 < k < r, and for any q £ Q r and a' G 



a fc ,...,a r GA 

= E l^-n^O^K I g[i, fc ],a') -/3 q[lfc] ((a',a fe ))(a')| 



a k eA 



= E 



(a')^ fc) («fc I Q[i,k], a') - 9™(a k \ q [1>k] , a') £ ((a', a)) 



^^)(a fc |g [life] ,a') 



/Wi]( a V£/W( a >)) 



/ 3 «J[i, fc -i]( a/ )-E^](( a, ' a )) 



where the second equality follows from the fact that the relation 



/Vfc](°[i,k]) =0 (fc) (°k 1 °[i.*-i])S^[i,*](( a [i.*-i]' a )) 
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holds no matter whether ^2 aeA k] ((o[i,fc-i], a)) > or not. Hence, 



SD(4 fe - 1) ,4 fe> ) = \ E \ h t 1} (a) - 4 fc> (a)| = \ £ 



aGA r 



a'64*" 1 



«L, fc -l]( a/ )-E^[l, fc ] ((«'>«)) 

aGA 



It follows from the triangle inequality that 



a'£A k - 1 



<Xq,k-l(a') - E^i.fe] ((«'>«)) 



aGA 



• (4) 



The first term of the right-hand side of the inequality (4) is exactly SD(a q> k-i, (3 q[1 k which is at most 
£cons(Q, A; — 1) by Claim 1. The second term of the right-hand side of the inequality (4) is bounded from above as 



5 E 



,'GA fe - 



<x q ,k-i(a!) -E^[i,fc](( a '' a )) 

aGA 



'GA fc - 



E a q ,fc((o', «)) " E ^[i,fc] (( a '' a )) 



aGA 



aGA 



^ J E KM ") -^[l,fc]( a ")| 



a"GA fe 

= SD(a q)fc ,/3 q[lifc] ), 

which is at most e cons (q, k) again by Claim 1. 

Hence, SD(/i^~ 1 \ /i^) < e C ons(<?, k — \) + e cons (q, k), as claimed. 

Claim 2 combined with the triangle inequality implies 



□ 



SD(4 1) ,4 r> ) < E SD (4 1 \h^ } ) <J2(econs(q,k - 1) + e cons (q,k)) < 2Y,e CO ns(q,k) = 2re cons (q). 

k=2 k=2 k=l 



Hence, 



Pr~Pi= E E hi\a)R(a \ q) - E E 4^ I 

<?GQ r aGA r <jGQ r aeA r 

= £ <i) E (4 r> 1 9) - 4 1} i g)) 

<?GQ r aGA r 

< E^SD^,^) 

< 2r ^ vr(g)e cons (g) 
= 2re cons , 

where the first inequality is due to the basic property of the statistical difference. Thus, 

Pr < Pi + 2re cons <p\ + 2re. 
Since pi < w(G) and p r > 1 — e(r), it follows from the inequality (2) that 

re > e(r) >l — p r >l — Pi — 2re > 1 — w(G) — 2re, 



or £ > 1 as desired. 
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4 Oracularization with a dummy question 



This section defines oracularization with a dummy question and proves Theorem 2 which states that NEXP has a 
two-prover one-round interactive proof system which is sound against entangled provers in a weak sense. Corol- 
lary 3, the scaled-down version of Theorem 2, is also proved. 

4.1 Definition of the transformation 

Theorem 2 and Corollary 3 are proved by transforming non-adaptive three-query PCP games to two-prover one- 
round games which are sound in a weak sense against dishonest entangled provers. 

Let G = (-7T, V) be a nonadaptive three-query PCP game. Oracularization with a dummy question of G 
gives a two-prover one-round game G' = ([Q] 3 ,{Q] 2 , A 3 , A 2 , R' ,ir'), where the predicate R' and the probability 
distribution tt' are specified as follows. 

The verifier V in G' chooses two triples (q\,q2, 93), (<?i, 92, Q3) £ [Q] 3 according to the distribution tt. Then 
he chooses q G {q\, q2,qs} and q G {q±, q 2 , q%} uniformly and independently at random. He decides r G {1, 2} 
according to the following rule: r = 1 if q < q, r = 2 if q > q, and choose r G {1,2} uniformly at random if q = q. 
He sends questions (qi, q 2 , (73) to the first prover. If r = 1, then he sends (q, q) to the second prover, and otherwise 
he sends (q,q). This specifies the probability distribution tt' over the set [Q] 3 x [Q] 2 . Upon receiving answers 
(ai, d2, 03) G ^4 3 from the first prover and (a' l5 a' 2 ) G A 2 from the second prover, V performs the following two 
tests: 

(Simulation Test) V verifies that R(ai,a 2 , a 3 | qi, q 2 , 93) = 1, 
(Consistency Test) V verifies that a£. = a,j when q = qj. 

The provers win if and only if they pass both tests. This specifies the predicate 

R'- [Q? x [Q? x A 3 x A 2 {0,1}. 

This transformation is different from the usual oracularization process of nonadaptive three-query PCP games 
explained in Subsection 2.3 in that V' also sends a dummy question q to the second prover without letting the prover 
know which question is "real." 

Note that without adding a dummy question, entangled provers could win perfectly in some games even if the 
unentangled provers cannot win perfectly, as noted in the introduction. On the other hand, we do not know whether 
the oracularization technique is necessary to bound the entangled value. That is, if we just add a dummy question 
to each prover without first applying the oracularization technique to the protocol, we do not know whether it is 
possible to bound the entangled value. 

The main lemma on oracularization with a dummy question is as follows. 

Lemma 8. There exists a constant c > such that for any nonadaptive three-query PCP game G = (Q, A, R, tt), 

w(G) < «w,,(C") < 1 - 1 ~3 < ° ) , 

where G' is the two-prover one-round game constructed by oracularization with a dummy question from G. 

4.2 Proofs of Theorem 2 and Corollary 3 

Here we prove Theorem 2 and Corollary 3 assuming Lemma 8. We need the following form of the PCP theorem 
based on the result of Khanna, Sudan, Trevisan and Williamson [22]. 
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Theorem 9. ( i) There exists a constant < s < 1 such that every language in NEXP has a nonadaptive three- 
query PCP system of perfect completeness with soundness error at most s and free-bit complexity log 2 3 (that 
is, the verifier accepts at most three out of the 2 3 = 8 possible results of reading). 

( ii) There exists a constant < s < 1 such that every language in NP has a nonadaptive three-query PCP system 
of perfect completeness with soundness error at most s and free-bit complexity log 2 3 where the verifier uses 
O(logn) randomness. 

Proof. Corollary 5.13 and Theorem 5.14 of Khanna, Sudan, Trevisan and Williamson [22] implies that given an 
instance of 1-IN-3 3SAT, it is NP-complete to distinguish whether it is satisfiable or no assignments satisfy more 
than a constant fraction of clauses. Part (ii) follows by restating this result in terms of PCP systems. Part (i) follows 
since the reduction in Ref. [22] is a local transformation and scales up to NEXP-completeness of the succinct 
version of the problem. □ 

Proof of Theorem 2. Apply oracularization with a dummy question to the PCP system in Theorem 9 (i) to obtain a 
two-prover one-round interactive proof system. By Lemma 8, this two-prover one-round interactive proof system 
satisfies properties (ii), (iii) and (iv). In this two-prover one-round interactive proof system, the first prover responds 
with three bits and the second prover responds with two bits. However, since the PCP system has free-bit complexity 
log 2 3, there are at most three possibilities for the answer of the first prover in the honest case, and therefore the 
answer of the first prover can be encoded in one trit. □ 

Proof of Corollary 3. Membership to NP is clear since the problem is at most as hard as deciding whether or not 
^unent (G) = 1 ignoring the promise. 

NP-hardness follows by applying Lemma 8 to the PCP system in Theorem 9 (ii) in the same way as the proof 
of Theorem 2. □ 

4.3 Proof of Lemma 8 

w uncn t(G') < 1 — (1 — w(G))/3 follows from Theorem 5. w uncnt (G') > w(G) is easy: let II 6 A® be a string 
which makes V accept with probability 10(G). The provers in G' achieve the same winning probability w(G) if the 
first prover answers (II[(ji], Ufa], life]) upon questions (qi,q2, 93), and the second prover answers (II [<^], II[g 2 ]) 
upon questions (q[,q' 2 ). 

In the rest of the section, we shall prove w com (G') < 1 — c(l — w(G)) 2 /Q 2 , where c = 1/(1 + 15\/2) 2 . 
Without loss of generality, we assume that all positions q G [Q] are queried with nonzero probability; otherwise 
drop the positions which are never queried. We define a probability distribution ir(q) over q 6 [Q] as 



If one chooses questions (qi,q2, 93) € [Q] 3 according to 7r(gi, g 2 , 93) and chooses one of qi, g 2 , q% uniformly at 
random, then q is chosen with probability ir(q). Also without loss of generality, we assume that the Q positions are 
labelled in the descending order of their marginal probabilities: 7r(l) > 7r(2) > ■ ■ ■ > n(Q) > 0. 
In the analysis of the soundness of the protocol, we use the following lemma. 

Lemma 10. Let M = {M a } ae A and N = {N a } a€ A be mutually commuting POVMs on a Hilbert space TC. Let 
\(f) G Jibe a state, and define two states |£) G C A ®TLby 




l<i<3 1< qi <q 2 <q3<Q 
Qi=Q 
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Let p be the probability with which joint measurement of M and N on \<p) gives different results: 



p=l-Y J ^WaN a W). 

aeA 

Then, 

£ 2 (|V>,|0)<2(l-(VlO)<2p. 
Proof. The first inequality is proved by Fact 1 : 

D 2 (\ip),\o) = i-mo) 2 

= (i + mmi - m)) 

< 2(1 - <vio>- 

The second inequality is proved as: 

1-^10 = 1-^1^^1^) 

aeA 

= l-^{<p\y/Mj^\<p) 

aeA 



< l-^tplMaNalif) =p. □ 



aeA 

Consider an arbitrary commuting-operator strategy in G', and let 1 — e be its winning probability. Without loss 
of generality, we assume that the state shared by the provers is pure and that every measurement performed by the 
provers is projective. 

As a preprocessing, we convert this strategy to a commuting-operator strategy where the second prover answers 
two identical answers whenever asked two identical questions. To achieve this, the new provers share an additional 
EPR pair (|00) + |11))/V2. The new second prover acts exactly the same way as the original second prover if his 
two questions are distinct. If his two questions are identical, then he first simulates the original second prover to 
obtain answers (a[, a' 2 ) € A 2 , uses the added EPR pair to simulate a classical coin flip to choose a' G {a[, a 2 } 
uniformly at random, and answers (a', a'). This preprocessing does not change the winning probability, the shared 
state is still pure, and every measurement is still projective. 

Let 6 V be a quantum state shared by the provers. For 1 < gi < 02 < 03 < Q, let M qiq2Q3 = 
{Mq^ q a ^} ai ^ a2 ^ a3( zA be the PVM measured by the first prover upon the questions (gi, 02, qs)- For 1 < q[ < q' 2 < 

Q, let N q > iq ' 2 = {N®, 1 ®, 2 }^ ja ' 2& A be the PVM measured by the second prover upon the questions q[, q' 2 . We use the 
notation M qiq2qz = {M q ^ q2 2 q a ^} ai ^ a2 ^ a3€ A for three distinct questions qi,q2,q3 £ [Q] even when they do not satisfy 
Qi < 12 < Q3- In this case, we define M q ^ q2 2 q a 3 A = Mq^qjffqjff , where a is a permutation on {1, 2, 3} such that 
Qa(i) < Qa(2) < Qa{3)- Similarly, if q[ > q' 2 , let iV^, = {N^} a' lA ' 2 eA be a PVM denned by = N^. 

By the preprocessing above, N^ 2 = N^, 1 no matter whether q[ = q' 2 or not. 

By the definition of no-signaling strategies, M qiq2q3 and N qq mutually commute. Then, under the condition 
that the verifier sends q\,q2, <73 to the first prover and q, q to the second prover, the probability with which the 
first prover returns answers 01,02,03 for 01,02,93, respectively, and the second prover returns answers b for q 
and a for q is given by {^\M q ^ q 2 q a 3 i N^~\^}. We denote the summation of PVM operators over all answers like 
K\ m = Sa 2 ,a 3e A^S a 3 3 or N q\ q q = EaeA^f ■ For ? ^ [Q], we define POVMs M q = {M«} aeA and 
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N q = {N-} aeA by 



KHJ l<i<3 l<qi<q2<q3<Q 
Qi=q 

N a q = E <S)Kw 

<?e[Q] 



Then the winning probability of this strategy is 



l ~ £ = \ E E E E n (QuQ2,q3)n(qi,q2,Q3)x 

1<<31<|?2<<?3<Q i<*<3 i<<h<g2<g3<Q ge{gi ,92,93} 

E (^^SKk^)^^ 2 ' °3 I ft, 92, 93) 

11,12,136^4 

= £ E E *(9i>«2>93) E (^IM™ 3 ^!^)^!,^,^ I 91,92,93). 

1<91<92<93<Q 1<*<3 ai,a 2 ,a3eA 

This strategy passes the CONSISTENCY TEST with probability 

1 " £cons = J] <*) 

gS[Q] aGA 

and the SIMULATION TEST with probability 

1 - £sim = ^ 7r(gi, 92, 93) (*|M™ 3 |*)i?(ai, a 2 , a 3 | c?i,92, 9s)- 

1<91<92<93<Q ai,i2,i3GA 

Note that e > e cons and e > e s i m . 

For simplicity of notation, let X q = ^M q and Y q = \J N%. We define a strategy 6 in the game G by 

9(U) = \\X* [Q] X* [Q - 1] ...x] 1[1] m 2 - 

This distribution can be explained as follows. The prover in G prepares the quantum state \^>), and measures the 
state using POVM {M± 1 } aie A to obtain a classical answer a\ G A and a post-measurement state Xf 1 Next, 
he measures this post-measurement state using POVM {M^^gA to obtain a 2 £ ^4 and a post-measurement state 
^2 2 X" 1 | \]/) . He repeats this for all the Q questions. Note that the order of the questions is significant. This strategy 
naturally induces 

0(ai, a 2 ,a 3 | 91,92,93) = ^ 0(11). 

neA« 

n[ ?i ]=a; (i=l,2,3) 

By assumption, 

^ 7r(?i, 92, 93) ^ 0(a 1 ,a 2 , a 3 \ q u q 2 , q 3 )R(a 1 ,a 2 , a 3 \ q 1 ,q 2 , 93) < w(G). (5) 

1<91<92<93<Q 1l,l2,«3eA 

Note the similarity of this construction to the "rounding" by Kempe, Kobayashi, Matsumoto, Toner and 
Vidick [20]. Following Ref. [20], we shall bound the winning probability 1 — e of the strategy in G' by prov- 
ing that (a) the measurements M q and N q are close, and (b) the operators X h q are pairwise almost commuting, 
which roughly correspond to Claim 14 of Ref. [20]. The fact that a dummy question is chosen independently from 
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the rest of the questions is important when proving these properties. Though the rest of the proof is similar to that 
of Ref. [20], our proof diverges from this basic idea superficially to obtain a little better bound. 
Let 

di(q) =n(j2 1°) ® *9°l*>- E 1°) ® W J > 9 e [Q], 

VaeA aeA ) 

d 2 {q\q) = D\Y J |a> ® *,°l*>, E l a > ® ^|«l*>) ' [Q], 
VaeA a€A / 

d 3 (9 I 9192%) = D I ^ |a) ® M^Jf), |a) ® Y g a |^) ) , 1 < 9l < ?2 < g 3 < Q, 9 G {ft, 92, 9s}, 

VaeA aGA / 

d4(qi,Q2) = D I J] |ai)|02> <8) JC«Jr«|*>, £ |ai)|a 2 ) I , 9i,9 2 e[Q]. 

Vai,a 2 eA ai,a26A y 

For notational convenience, we denote (d\(q)) 2 as d\ (q), d 2 (q | q')) 2 as d|(9 | q'), and so on. 
Claim 3. 



cons , 

Ea,g[d2(9 I 9)] < 2e cons , 
E (9i,92,<?3) E *[ d i(9i I 919293)] < 2e cons , 
E 0l , 02 [^(91,92)] < 32e 

cons , 



(6) 
(7) 
(8) 
(9) 



where E a [] denotes the average over q G [Q] weighted by n(q), E ?1)02 [] denotes the average over qi,q 2 G 
weighted by Tr(qi)7r(q 2 ), E( 01)02)03 ) [] denotes the average over qi, q 2 , (73 G [Q] weighted by 7r(gi, q 2 , qs), and Ej 
denotes the average over i G {1, 2, 3} weighted uniformly. 

Proof. Eqs. (6), (7) and (8) are proved in a similar way by using Lemma 10. For Eq. (6), by Lemma 10, 



dl(q) = D 2 (j2 l«> ® E ® W J 

VaeA aeA / 

<2(l-£<tt|M«#«|tf>) , 

V aeA / 



which implies 



For Eq. (7), by Lemma 10, 



E,[d?( 9 )] < 2E, 



l-£<tf|M°iV, |tf> 

aeA 



2£c 



d|( 9 |g)<2(l-^(*|M«AT ? y*)) , 

V aeA / 



which implies 



Ea, g -[^2(9 I 9)] < 2Eg,g 



i-^(*|M ? a iv g y*) 

aeA 



2e r 
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For Eq. (8), again by Lemma 10, 



4(q | 919293) < 2 1 - E^I^W^I*) - 
V aeA ) 



which implies 

E( gi) ,a,,s)Ei[^(« I 9i929s)] < 2E( ?1 ,, 2i53 ) Ei 
For Eq. (9), 



— 2s cons . 



E |ai)|a 2 )®X^|*), ^ l^l^®^^!*) <d 2 (9i|92), (10a) 

\ai,a,2(zA ai,a,2(zA J 

D [ E MMa^WW' E ^^(9 2 |9i), doc) 

<2l|<2l«2 <?ikl<?2 9192 9219192 <?l|<?l<?2' v y 

E MM^W^iWI*>' E mm^^u^i*)) < I »)- ( 10e ) 

Vai,a2GA ai,a2GA / 

^q2\qiq2 X ii ~ X n "^^ki^' (10f) 

£>( E lai)^^; 1 ^!*), J] \ ai )\a 2 )®X£X%\*)\<d 2 (q 2 \ qi ), (lOg) 

where Eqs. (10a), (10c), (lOe) and (lOg) follow from monotonicity of the trace distance and Eq. (lOd) follows since 
N qiq2 is a PVM. Eqs. (10a)-(10g) imply 

^4 (91,92) < 2(d 2 (?i I 92) +^2(92 I 9i)) • 

By Eq. (7), 

^1(91, 92) < 4(d 2 (gi I 92) + d 2 (92 I 9i)) 2 
< 8(^(91 I 92) + d2(92 I 9i)), 
where the last inequality follows from the Cauchy-Schwartz inequality. By using this, Eq. (9) is proved as follows: 

E gi ,q 2 [di(9i,92)] < 8E ?1 , ?2 [d 2 (9i I 92) +^(92 I 9i)] 

< 32e cons . D 

Claim 4. Let m> 1, ti, . . . , t m € [Q] and 1 < i < m. Then 

\ \\\x z cx z c:i...x z t im 2 - \\xi----xzixt::i---xiixt;\n\ 2 \ 



2 



<2 E difatj) 

i<j<i-i i<j<»-i 
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Proof. We prove the claim by hybrid argument. For 1 < j < m and z S A m , let X? = X^ J and Yp = Y^ 3 . 
For 1 < j < f < m, let Xfc d] = X^Xp^ ■ ■ ■ X? and Yj*^ = Y/Y/ +1 • • • Yp. For j'' = j - 1, we let 
^b' o] = ^{j j'] = ^' ^ or ^ — we define probability distributions p, and p^ on A m by 

PiW = ll^ 1 ^ J --i]l*>ll 2 , 

= ll^i+ii^-ui^ij-ii^l*)!! 2 - 

For j = 1 and j = i, these probability distributions are written as 

pi(z) = \\x^ 1] m 2 , 

p[(z) = \\X( m . +1] Xf i _ hl] Xf\*)\\ 2 , 



and 



Pi (z) = \\x( m . ] Y [ i._ 1] m\ 2 , 
Pi^) = \\x( m , i+1] Y^ i _ 1] xi\m 2 - 

Note that pj(z) = p'^z) since X? commute with Yp for 1 < j' < i — 1. 
By using pj and p^-, the inequality to prove can be written as 

£>(pi,pi)<2 di(tj)+ d4(tj,*i). 

l<j'<i-l l<j<i-l 

We prove this by proving 

D( Pj ,p j+ i) < di(tj), 1 < i < * - 1, (11) 

£>(p^+i,^-)<di(tj) + d4(ti.<j). 1 < J < * - 1- (12) 
We prove Eq. (11). By monotonicity of the trace distance, 

\ E Ill^- + i]^--i]^l*>ll 2 - ll^ + i]^-i]5?l*>ll 2 | < d3) 

zeA m 

The second term inside the absolute value is equal to pj + \(z). The first term is equal to Pj(z) since X? commute 
with Yp for 1 < j' < j — 1. Therefore, Eq. (13) is identical to Eq. (11). 

To prove Eq. (12), let Z = X* m i+1 ]X^_ 1 j+ij^i Then by monotonicity of the trace distance, 

1 £ |||zxfy/|^)|| 2 - ||zxfx||*>|| 2 | < (14) 

zG/l m 

1 \\\zxzx*m 2 -\\zxzx*m 2 \ <<k(u,tj). as) 

Note that X? commute with Yp. This implies that p' j+1 (z) = \\ZX£Yp\ty}\\ 2 . Since XJ commute with Y^ for 
j + 1 < f < m, \ZX Z -Xf \^)f = p'-{z). Eq. (12) is obtained by adding Eqs. (14) and (15). 
By summing up Eqs. (11) and (12) over 1 < j < i — 1, 

D{p 1 ,p' 1 )<2 d 1 (t J )+ d 4 (ti,tj). □ 

l<j<i-l l<j<i-l 
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Now let 91,92,93 G [Q]. We start with 0(11) = \\X% lQ] X% 1 ?~ 1] ••• xf™ |^)|| 2 and bring X% lqi] , X§ q2] 

and X^' 93 ' to the nearest to |^) by applying Claim 4 three times. Recall that questions 1, . . . , Q are sorted in the 
descending order of their marginal probabilities. If we write the Q — 3 elements of [Q] \ {91 , q 2 , 93} as v\ , . . . , vqs 
in the same order as 1, . . . , Q, we obtain 



\ £ |*(ii)- iiJc5^- B] ^«- al - - - ^s^ijs-s^ijfgM a-s[*]|*>ii 2 | 



2 



< E 2 E E 

l<j<3 \ l<q'<qi-l l<g'<9i-l 



Note that 



2 ||<jT sI *2T aI • • • < w if ll xf 2l i° tel |*)|| 2 = \\X%X%X%\9)\\ 2 , 



n[qi]= ai (i=l,2,3) 



and therefore, 



± ^ ^(01,02,03 |9i,92,93)- \\X%X%X%\*)\\ 2 \ < E ( 2 E ^0 + E d 4(%,9')) 

01,02,036^ 1<«<3 \ l<<?'<<?i-l l<9'<g»-l / 

(16) 

By monotonicity of the trace distance, 

\ \\\ x £ x %K 3 \m 2 - IW*3WI*>II 2 I < 

01,02,036^4 

\ E \\\Y q rX£X%\y)\\ 2 - \\Y£X%Y£\*)\\ 2 \ < di(q 2 ), 
01,02,036^1 

\ E \\\Y q 7Y£X£\y)\\ 2 ~ \\Y£Y£Y£\*)\\ 2 \ < di(qi), 



01 ,02,03 6 A 

which implies 



\ \W X v X % X q?\n\ 2 - \\Y£Y£Y£\*)\\ 2 \ < d 1 (q 1 ) + d 1 (q 2 ) + d 1 (q 3 ). (17) 

01,02,036^ 

Similarly, 

\ E lire^^M*>ii 2 -iiK«ffi*>ii 2 l 

01,02,036^ 

= - Hl^C 2 ^ 1 !*)!! 2 - Il^" ai i M a ] M a ' A , m\\ 2 \ 

2 / j 1 11 <?3 <?2 gi 1 /11 11 gi|gi02Q3 g2|gi02g3 g3|gig2g3' ' 11 I 

oi,02,036A 

< E d ^ qi I 919293), (18) 

l<i<3 

where the first equality is since M qiq2qs is a PVM. 
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By Eqs. (16), (17) and (18), 

\ E \0{ai,a 2 ,a z \ 91,92, 9s) - \\M£ q %f\V)\\ 2 \ < d( qi ,q 2 ,q 3 ), 



where 



d(qi,q2,q3)= E 2 E E d i(n^') + d i(Qi) + MQi \ QiQ2q3) 

l<i<3 \ l<q'<q t -l l<q'<qi-l 



< E 2 E E M<li,Q') + d3(Qi \Q1Q2q3) 

l<i<3 \ l<q'<qi l<q'<qi~l / 



V 



By the linearity of expectation, 

E^,^) [^91,92, 93)] < 6 E g 



E 


+ 3 Eg 


1<9'<9 





E ^4(9,9') 

1<9'<9-1 



+ 3E( gi ,g 2 ,g 3 ) Ej[d 3 (% I 9l929s)]- 

(19) 



We bound each term of the right-hand side of Eq. (19). As for the first term, 

2 / \ 2 



Eq 



E d *tf) 

i<q'<q 



As for the second term, 



E 



E d 4 (<?,<?') 
1<?'<9-1 



E ^H(?0 

V 1<9'<9<Q 

< [ e ^'h^o 

K l<q'<q<Q 

<Q 2 ( E ^'W) ) =Q 2 (E^[rfi(9')])' 
\i<<?'<<2 

<Q 2 E 9 4^(9')] 

5^ Scons- 



2 / \ 2 

E 7r («)' i 4(9,9 / ) 

1<9'<9<Q 



(9' < 9 71(9') > 7T(9)) 



(by Claim 3) 



< ( E VM<lWjd 4 (q,q') 

l<q'<q<Q 

(9' < 9 => 7r(q') > <q) => V^W) > 



<i( E ^(9)^(90^4(9, 9')] 

\l<g,g'<Q / 



— ~/T E 7T ( ( l) 7T (l') d 4:(l^ < l') (by the Cauchy-Schwartz inequality) 



l<q,q'<Q 
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Q 2 

<8Q 2 e cons . (by Claim 3) 

As for the third term, 

{B (quq2m) Bi[d 3 (qi | gi,g 2 ,9 3 )]) 2 < E (91i?2i?3) Ei[dg(ft | 91,92,93)] 

< 2e cons . (by Claim 3) 

Therefore, 

E (9i,<? 2 ,<? 3 )[ d (9i,92,93)] < 6\/2Q^/e cons + 3V8Q^e cons + 3\/2^/£ cons 
= (12^/2 Q + 3V2)^/i 

cons 

< 15\/2<5V£cons- 

By Eq. (5), 

1 - If (G) - £ sim < |1 - w(G) - £ s i m | < E( ?1) q 2j?3 ) cons , 

which implies 



£sim> l-w(G)-15V2QV£c 



Since e > e sim and e > e cons , 



\/e > e > £sim > 1 - w(G) - 15^2(5^^ > 1 - w(G) - lbV2Q^, 

which implies 

. l-w(G) \\ (l-w(G)r 



1 + 15V2QJ ~ (1 + 15^2) 2 Q 2 ' 
This means that Lemma 8 holds with c = 1/(1 + 15\/2) 2 - 

Remark. Kempe, Kobayashi, Matsumoto, Toner, and Vidick [20] essentially uses nonadaptive two-query PCP 
systems with a nonboolean alphabet as a base case. We use nonadaptive three-query PCP systems with the boolean 
alphabet to make the answers in the resulting games shorter. Note that this difference is not essential unless we 
are not concerned with the answer length: if we allow four-bit (or more precisely, two-trit) answers in the resulting 
games, then we could use nonadaptive two-query PCP systems with the ternary alphabet as well. 

Actually, if we define "nonadaptive t-query PCP games" for general t G N analogously to the definition of 
nonadaptive three-query PCP games, it is easy to generalize oracularization with a dummy question to nonadaptive 
t-query PCP games, and Lemma 8 also applies by changing the coefficients 1/3 and c in the statement depending 
on t. 
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